getcredentials answered xcat_secure_pw only for root, so a postscript
had no way to get the password of another node account from the passwd
table.
xcat_secure_pw:<user> now returns the password field of the passwd row
key=system,username=<user> when <user> is root or a sudoer named in the
postscripts or postbootscripts of the requesting node, its osimage, or
xcatdefaults. A sudoer without a row or without a password gets the
locked field "!", so the node applies the reply as is. Any other user,
an invalid user name, or a failed hash answers with an error instead of
an empty reply. The root request reads the same row as before and keeps
the error reply for a missing row.
Docker container lifecycle management (mgt=docker, mkdocker, rmdocker,
lsdocker) was added in 2015-2016 as an experiment targeting Docker API
v1.22 on Ubuntu only. Documentation and man pages were deliberately
removed in 2019 (PRs #6222 and #6324) with the original developer's
approval, noting that "the interface of Docker has become very simple
right now, so there is no value for xCAT to offer such functions."
The plugin was still being shipped but has had no functional code changes
since April 2016, was never listed as a valid mgt value in Schema.pm,
and no user ever filed an issue about it.
Removed:
- xCAT-server/lib/xcat/plugins/docker.pm (1,142 lines)
- xCAT/postscripts/setupdockerhost
- xCAT-server/share/xcat/scripts/setup-dockerhost-cert.sh
- xCAT-test/autotest/testcase/dockercommand/ (test cases)
- Docker attribute definitions in Schema.pm
- Client symlinks (mkdocker, rmdocker, lsdocker)
- Usage entries and dockerhost cert handling in credentials.pm
- Docker attribute documentation in man7 pages
The "Running xCAT in Docker" documentation (dockerized_xcat/) is
retained as it documents containerizing xCAT itself, not the removed
mgt=docker feature.
Closes#7518
- support xcat_secure_pw:<user> API in credential plugin
- for diskless, if enabled secure root, packimage will not write root password into image
- for stateful, if enabled secure root, nodeset will not write root password into config file
- and 'remoteshell' will update shadow file accordingly
- clear logs in the key components during provisioning (not only debug mode, but debug mode will have more logs)
- now only cover rhel7 stateful and stateless
- make more syslogs into cluster.log (tag = xcat or xcat.*)
- the changes will not impact other distro
-Implement 'getcredentials' for a krb5 keytab, requires documentation
-Have getcredentials.awk fundamentally capable of requesting multiple credentials in a single request (theoretical scaling)
git-svn-id: https://svn.code.sf.net/p/xcat/code/xcat-core/trunk@2908 8638fb3e-16cb-4fca-ae20-7b5d299a9bcd
Vinícius Ferrão
Jarrod Johnson
Kurt H Maier
GONG Jie
Bin Xu
Matt Ezell
Mark Gurevich
zhaoertao
lissav
jbjohnso
mxi1
zhanx
nott
lissav